Attention, lockdown DIY fans: UK hardware flinger Robert Dyas had credit card data and more skimmed from website

British hardware chain Robert Dyas' website has been hit by credit-card stealing malware that siphoned off customers' payment details including the long card number, expiry date and security (CVV) code. Between 7 and 30 March a card skimmer was present on Robert Dyas' payment processing page, the chain admitted in an email …

[Woodnag]

Hmm

"We became aware on 30 March 2020 that malicious software (malware) had been uploaded on to our ecommerce website by an external third party, which was immediately blocked by our IT Security team"

malware... uploaded... immediately blocked. Sounds good, until you read more carefully.

[DRue2514]

Re: Hmm

"We became aware". Sounds like they didn't detect this themselves either.

[Anonymous Coward]

Credit Card Skimmers

If you would like to see what a typical card skimmer looks like, check out the webpage source of:

https://www.antiquesilverspoons[.]co[.]uk/

(starting at line 1098)

This site has been infected for a long time and they don't respond to email.

I believe the C&C of the skimmer is also sinkholed by a well-known security outfit to render it somewhat benign.

[Captain Scarlet]

Well balls

Ordered twice from Robert Dyas in March, where is my bloody we care about you email as I havent had one yet!

[Oh Matron!]

Re: Well balls

Haven't had the opportunity / misfortune to order from them online, but I find Dyas to be one of the more useful shops on the high street (I don't drive).

[Captain Scarlet]

Re: Well balls

The courier lost one box as well, filled out the bloody form for a missing item and the courier then found it and had the cheek to moan at me saying why did I reject one box (I didn't, you didn't bloody load it on the van!).

[Neil Barnes]

'Skimmer' and 'CCV' = a website vuln, not backend?

I'm just seeking education here. The difference would be whether over the counter sales / card payments are affected.

[mj.jam]

Re: 'Skimmer' and 'CCV' = a website vuln, not backend?

Yes, a skimmer means somebody got something into their website that reported your details to them (as well as to Robert Dyas). Similar to a skimmer over the slot of a cash machine which reads your cards as they are used. Doesn't stop the data being used for the original purpose, but separately reads it.

Typically CCV numbers are not stored by people, so if they are exposed then that would show either they have stored them in their DB (which is very naughty) or that somebody skimmed them on the way.

[Mike 137]

"“As soon as we became aware..."

“As soon as we became aware of the presence of malicious software ... we took immediate action to remove it."

Meaning: "it took us three weeks to detect this".

Why?

Elementary: nobody was looking. Nobody ever seems to these days. In many organisations I've consulted with, logs are gathered, but only inspected after a breach has been detected by other means (usually either pure chance or some jorno pointing it out in public).

[Bonegang]

there are tools...

...to detect this kind of thing pretty much immediately.

Scanning the pages on an hourly/daily basis and notifying on diffs is an established method.

Why does it seem too expensive until the moment they are compromised...?